Ask HN: How secure is GPG using a symmetric cypher?

Posted by brdrak on Tuesday September 10, 2013 @12:41AM
from the ask-hn dept.

If I encrypt a file using a 20 character password like so:

  gpg -c --force-mdc file

Assuming the password doesn't appear on any dictionary lists, and has enough randomness to require brute force, how secure is the result?

( 6 comments | 5 points | on HN )

Re:Ask HN: How secure is GPG using a symmetric cypher? by tptacek on Tuesday September 10, 2013 @09:17AM (#6359784)

Very secure.

GPG doesn't have a particularly great KDF, so shorter passphrases are an issue, but a 20 character passphrase compensates for that.

[ Parent | on HN ]

Re:Ask HN: How secure is GPG using a symmetric cypher? by brdrak on Tuesday September 10, 2013 @11:42AM (#6360693)

Thanks. Secure enough to store out in the open (e.g. public git repo, etc)?

[ Parent | on HN ]

Re:Ask HN: How secure is GPG using a symmetric cypher? by olefoo on Tuesday September 10, 2013 @01:26AM (#6358341)

First question, are you certain there is no keylogger on the computer you are typing the password on?

O yeah, keyloggers don't have to be in your computers software either https://freedom-to-tinker.com/blog/felten/acoustic-snooping-...

[ Parent | on HN ]

Re:Ask HN: How secure is GPG using a symmetric cypher? by drill_sarge on Tuesday September 10, 2013 @09:37AM (#6359906)

You boot from a Live-CD. But then maybe someone has put a logger in your keyboard. Or doing powerline monitoring. Or watching you with infrared camera. And so on...

[ Parent | on HN ]

Re:Ask HN: How secure is GPG using a symmetric cypher? by brdrak on Tuesday September 10, 2013 @12:36PM (#6361142)

Let's say I have access to multiple computers at several locations, and at least one is secure. I encrypt the plain text on c1, put on a USB key, encrypt the encrypted file again on c2. Then again. Then transfer the file to a new USB key and destroy the original (in case file system there has remnants of other files).

The adversary would have to know all three passwords to decrypt the final file.gpg.gpg.gpg, correct?

[ Parent | on HN ]

Re:Ask HN: How secure is GPG using a symmetric cypher? by cpach on Tuesday September 10, 2013 @09:33AM (#6359884)

Um. How could he ever be certain of that?

[ Parent | on HN ]